Linux-PAM (< 1.7.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/linux-pam--1.7.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 16:59:36 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLinux-PAM: Local privilege escalation in pam_namespace (CVE-2025-6020)https://feed.craftedsignal.io/briefs/2026-11-cve-2025-6020/Tue, 10 Nov 2026 16:59:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2025-6020/A local privilege escalation vulnerability in the Linux-PAM pam_namespace module allows low-privileged users to gain root access via symlink attacks and race conditions.CVE-2025-6020 is a local privilege escalation vulnerability identified in the Linux-PAM pam_namespace module. The vulnerability, classified as CWE-22 (Improper Limitation of a Pathname Parameter), allows a low-privileged user to exploit race conditions and symlink attacks when the module handles user-controlled paths. This can lead to unauthorized escalation to root privileges. The issue was fixed in Linux-PAM version 1.7.1.

Impact

Successful exploitation allows a local user with low privileges to achieve root-level code execution on affected Linux systems.

Recommendation

  • Upgrade Linux-PAM packages to version 1.7.1 or later across all Linux distributions.
  • Audit systems for users with local shell access who might attempt to leverage this symlink/race condition vector.
]]>highadvisorylinuxpamprivilege-escalationcve-2025-6020